diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md
index 122ed83..f639e76 100644
--- a/serverAppConfigs-docs/log.md
+++ b/serverAppConfigs-docs/log.md
@@ -11,6 +11,40 @@ timestamp: 2026-09-14
 
 # Bundle Change Log
 
+## 2026-09-21 — Calibre Content Server deployed (dankserver :8084)
+
+- **The change.** The Calibre Content Server (`calibre-server`) is now a
+  live, boot-persistent, self-healing Quadlet service on dankserver
+  (`dankserver/calibre-server/quadlet/calibre-server.container`), serving
+  the shared library at **192.168.0.235:8084** (OPDS + web UI), HTTP Basic
+  auth, single admin `calibre`. LAN-only: no vhost, no public DNS.
+- **Why the desktop image.** The compose-era snippet assumed the old
+  headless `lscr.io/linuxserver/calibre`; the current 9.15.0 is a desktop
+  build (Selkies GUI). The dedicated headless images (ta264, agentgreen)
+  are dormant (calibre 6.10 / 2017, both below the 9.9.0 content-server
+  fix). The unit runs `calibre-server` as the image's s6-overlay main
+  service via `Exec=`; the desktop also runs but its ports are
+  internal-only (pasta is port-forward mode here — only the 8084 forward
+  is exposed).
+- **Auth traps found by testing.** (1) calibre 9.x users live in a SQLite
+  userdb whose `pw` column is plaintext (file must be mode 600); bootstrap
+  is `--manage-users -- add` with the password on stdin via `printf` — an
+  `echo` trailing newline lands in the stored password and breaks every
+  login. (2) On a non-SSL port the server defaults to Digest auth and
+  rejects Basic clients with `400 Unsupported authentication method` —
+  `--auth-mode=basic` is pinned. (3) 8080 inside the container is the
+  image's own nginx, so the content server runs on internal 8090.
+- **Calibre-Web → authentik.** Feasibility answered: NOT via in-app OIDC
+  RP (Grafana's path) — Calibre-Web 0.6.27 has no generic OIDC (verified
+  in the container: no OIDC config keys, no authlib; upstream has an open
+  feature request and the maintainer declines more login options). The
+  fleet-standard path is the guard chain (Anubis → authentik proxy
+  provider), which needs no app change; Calibre-Web's own login (local /
+  LDAP / GitHub / Google only) would remain a second layer, romm-style.
+  Not migrated yet (verification-only per the operator).
+- **Docs.** `Dankserver/Calibre.md` content-server section rewritten from
+  "not running" to the deployed shape.
+
 ## 2026-09-21 — frank-large: CIRU Orca → unsloth llama.cpp Qwen3.8-Flash-Next UD-IQ4_XS
 
 - **The change.** At the operator's request, frank-large (dankclaw :7770)